A Secure And Reliable Storage Above Public Clouds Maxim Schnjakin

Transcription

1 A Secure And Reliable Storage Above Public Clouds Maxim Schnjakin

2 Outline 2 Motivation Focus and challenges Our approach Cloud storage layer Security and reliability Data distribution Recent results Conclusion and future work

3 Motivation and Challenges 3 Focus Infrastructure as a Service Storage as a Service Challenges Identification of the best services Reliability & Availability Security Data Lock-in

4 Requirements 4 Identification of the algorithm to increase the availability and reliability of the outsourced data Assurance of data security and integrity Identification of the best source description of BSPs Identification of the selection parameters description of user requirements Information quality and actuality

5 Possible solution 5 Replication of data as a solution? Missing API standardisation makes the integration process difficult Not cost-efficient

6 Cloud-RAID 6 File F GoGrid Nirvanix Rackspace Amazon S3 Device A Device B Device C Device D RAID-Algorithm

7 Cloud-RAID Architecture 7 Cloud Storage Layer Cloud-RAID Ressourcen Management web Web service Portal user interface Nutzerinterface Amazon S3 GoGrid Anwender User Nirvanix SND Rackspace...

8 Implementation 8 User Interface Data Management Specification of the requirements Costs Performance Availability

9 Increasing the Availability 9 In general the SLAs of the most BSPs assure uptimes from 99,9% to 99,99% AF = assured value of uptime AP = average availability of a BSP n, k = Erasure paramaters

10 Performance Measurement Time taken (milliseconds) kB kB 1MB 10MB 100MB Cloud-RAID [3:1] Cloud-RAID [4:3] Cloud-RAID [6:1] Encoding performance of Cauchy-Reed-Solomon

11 Improvement of Jerasure Library 11 Time taken (in milliseconds) Cloud-RAID Jerasure -21% -25% -27% [3, 1] [4, 2] [10, 1] Time taken (in milliseconds) Cloud-RAID Jerasure -51% -63% +18% [3, 1] [4, 2] [10, 1] Erasure configura ons [k, m] Erasure configura ons [k, m] Encoding of a 100kB data object Decoding of a 100MB a data object

12 Overhead Costs Time taken (in ms) Encode Upload 0 1 MB 10 MB Cloud - RAID [4,2] Encode 47 ms = 0,3% 15 ms = 0,37% Upload ms = 99,7 % 4042 ms = 99,63 %

13 Security 13 Initial assumption: no encryption is required, due to physical segregation of data Implementaion of an erasure algorithm operating on bit level Encryption is required before OR after the application of erasure algorithms?

14 Performance Measurement 14 Time taken (in milliseconds) encode encrypt encrypt encode Time taken (in milliseconds) encode encrypt encrypt encode 0 [4,1] [4,2] [6,1] [6,2] [10,1] [10,2] [10,3] 0 [4,1] [4,2] [6,1] [6,2] [10,1] [10,2] [10,3] Erasure configura ons [k, m] with a 100MB data object Erasure configura ons [k, m] with a 100MB data object Processing of a 100MB data object on a dual-core CPU Processing of a 100MB data object on a quad-core CPU Implementation of both alternatives

15 Implementation 15 Implementation of the Liberation and Cauchy- Reed-Solomon algorithm in C Embedment of C-libraries with Java-JNI Meta data is stored in the local data base Data processing (encoding) on the side of the user Anwender Webbrowser Java-Applet Database Libraries erasure.jnilib Internet Amazon S3 GoGrid unsere Plattform

16 Data Distribution 16 Each BSP is integrated by the system by means of a Storage- Service-Connector which cover the basic operations like: create(bucket) write(object) getdigest(object)... Storage-Connectors require individual implementation

17 Evaluation 17 Write of a 100MB data object Read of a 100MB data object Time teken (in seconds) Time teken (in seconds) Cloud-RAID improves the throughput performance The total transfer time depends on the performance capabilities of individual providers

18 Evaluation 18 Write of a 100kB data object Read of a 100kB data object Time taken (in ms) Time taken (in ms) BSPs seem to have optimized the infrastructure for specific use cases There is a striking difference in the up- and download capabilities of cloud services

19 Evaluation 19 Write of a 100kB data object Read of a 10 MB data object Time taken (in ms) Time taken (in seconds) BSPs seem to have optimized the infrastructure for specific use cases (Google e.g. improves the performance with growing file size) Cloud-RAID performance differs depending on provider setting and file size - the fastest settings consist of the fastest clouds

20 Provider Setting 20

21 Economic Consequences 21 Vendors differ in pricing schemes and performance characteristics In general, pricing depends on the amount of data stored and bandwidth consumed number of requests Erasure Codes increase the total costs, due to produced storage overhead higher number of requests

22 Economic Consequences 22 Upload Costs KWR = costs for an average write request KRE = average costs for an executed request (e.g. gethash()) SF = file size Download Costs KRD = costs for an average read request KRD(SF)+k* KRE

23 Economic Consequences 23 Costs in $ for reads Costs in $ for writes

24 Conclusion 24 Cloud-RAID improves the throughput performance when compared to with cloud services individually Improvement in the availability and reliability by providing a better economical efficiency we are able to tolerate the outage of service providers (by data overhead of less than 10%) Improvement in security Physical segregation of original data objects None of the vendors is in absolute possession of data providers are not able to misuse entrusted data Encryption is still required Reduction of lock-in by similar costs

25 Future Work 25 Integration of additional storage providers The solution to the single source of failure problem Performance optimization of the system

26 Thank you for your attention 26 Questions? Remarks? Maxim Schnjakin: Hasso-Plattner-Institute, University of Potsdam, Germany Dipl.-Inf. Maxim Schnjakin 10. Mai 2011 IT-Sicherheitskongress